deserialization issue

[outlawed]

i am getting a SerializationException -

Execution of message listener failed, and no ErrorHandler has been set.
org.springframework.data.redis.serializer.SerializationException: Cannot deserialize; nested exception is org.springframework.core.serializer.support.SerializationFailedException: Failed to deserialize payload. Is the byte array a result of corresponding serialization for DefaultDeserializer?; nested exception is java.lang.ClassCastException: cannot assign instance of org.springframework.beans.factory.support.StaticListableBeanFactory to field org.springframework.aop.scope.DefaultScopedObject.beanFactory of type org.springframework.beans.factory.config.ConfigurableBeanFactory in instance of org.springframework.aop.scope.DefaultScopedObject
at org.springframework.data.redis.serializer.JdkSerializationRedisSerializer.deserialize(JdkSerializationRedisSerializer.java:81)
at org.springframework.data.redis.core.AbstractOperations.deserializeHashValue(AbstractOperations.java:335)
at org.springframework.data.redis.core.AbstractOperations.deserializeHashMap(AbstractOperations.java:279)
at org.springframework.data.redis.core.DefaultHashOperations.entries(DefaultHashOperations.java:227)
at org.springframework.data.redis.core.DefaultBoundHashOperations.entries(DefaultBoundHashOperations.java:102)
at org.springframework.session.data.redis.RedisOperationsSessionRepository.getSession(RedisOperationsSessionRepository.java:432)
at org.springframework.session.data.redis.RedisOperationsSessionRepository.onMessage(RedisOperationsSessionRepository.java:519)
at org.springframework.data.redis.listener.RedisMessageListenerContainer.executeListener(RedisMessageListenerContainer.java:249)
at org.springframework.data.redis.listener.RedisMessageListenerContainer.processMessage(RedisMessageListenerContainer.java:239)
at org.springframework.data.redis.listener.RedisMessageListenerContainer$1.run(RedisMessageListenerContainer.java:967)
at java.lang.Thread.run(Thread.java:745)
Caused by: org.springframework.core.serializer.support.SerializationFailedException: Failed to deserialize payload. Is the byte array a result of corresponding serialization for DefaultDeserializer?; nested exception is java.lang.ClassCastException: cannot assign instance of org.springframework.beans.factory.support.StaticListableBeanFactory to field org.springframework.aop.scope.DefaultScopedObject.beanFactory of type org.springframework.beans.factory.config.ConfigurableBeanFactory in instance of org.springframework.aop.scope.DefaultScopedObject
at org.springframework.core.serializer.support.DeserializingConverter.convert(DeserializingConverter.java:78)
at org.springframework.core.serializer.support.DeserializingConverter.convert(DeserializingConverter.java:36)
at org.springframework.data.redis.serializer.JdkSerializationRedisSerializer.deserialize(JdkSerializationRedisSerializer.java:79)
... 10 common frames omitted
Caused by: java.lang.ClassCastException: cannot assign instance of org.springframework.beans.factory.support.StaticListableBeanFactory to field org.springframework.aop.scope.DefaultScopedObject.beanFactory of type org.springframework.beans.factory.config.ConfigurableBeanFactory in instance of org.springframework.aop.scope.DefaultScopedObject
at java.io.ObjectStreamClass$FieldReflector.setObjFieldValues(ObjectStreamClass.java:2133)
at java.io.ObjectStreamClass.setObjFieldValues(ObjectStreamClass.java:1305)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1942)
at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2018)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1808)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1353)
at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2018)
at org.springframework.aop.framework.AdvisedSupport.readObject(AdvisedSupport.java:557)
at sun.reflect.GeneratedMethodAccessor117.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1058)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1909)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1353)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1808)
at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2018)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1942)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1808)
at java.io.ObjectInputStream.readObject(ObjectInputStream.java:373)
at org.springframework.core.serializer.support.DeserializingConverter.convert(DeserializingConverter.java:73)
... 12 common frames omitted
at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2024)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1808)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1353)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1942)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1353)
at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2018)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1942)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1808)
at java.io.ObjectInputStream.readArray(ObjectInputStream.java:1714)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1347)
at java.io.ObjectInputStream.defaultReadObject(ObjectInputStream.java:503)
at java.lang.reflect.Method.invoke(Method.java:498)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1808)
at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2018)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1942)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1353)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1808)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1353)
at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2018)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1942)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1353)
at org.springframework.core.serializer.DefaultDeserializer.deserialize(DefaultDeserializer.java:70)

I am using springBootVersion = '1.5.3.RELEASE'. I am using Redis for session replication and the application is deployed in cloud.

[kshitij-kasliwal]

@dsyer @rwinch this one seems different than #395. I am also facing the same issue.
springBoot is on '1.5.4'.

[sanaulla123]

@dsyer @rwinch
Facing the same issue as well, running on spring boot 1.5.2

Our scenario: two different client apps persisting session to Redis and both using the same SESSION cookie value. We tried removing Dev tools dependency, but no success.

We are authenticating using OAuth server and the client apps are our OAuth clients using Redis to store the authenticated session.

Caused by: java.lang.ClassCastException: cannot assign instance of org.springframework.beans.factory.support.StaticListableBeanFactory to field org.springframework.aop.scope.DefaultScopedObject.beanFactory of type org.springframework.beans.factory.config.ConfigurableBeanFactory in instance of org.springframework.aop.scope.DefaultScopedObject
        at java.io.ObjectStreamClass$FieldReflector.setObjFieldValues(ObjectStreamClass.java:2133)
        at java.io.ObjectStreamClass.setObjFieldValues(ObjectStreamClass.java:1305)
        at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2251)
        at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2169)
        at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2027)
        at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1535)
        at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2245)
        at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2169)
        at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2027)
        at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1535)
        at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2245)
        at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2169)
        at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2027)
        at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1535)
        at java.io.ObjectInputStream.readArray(ObjectInputStream.java:1933)
        at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1529)
        at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2245)
        at java.io.ObjectInputStream.defaultReadObject(ObjectInputStream.java:552)
        at org.springframework.aop.framework.AdvisedSupport.readObject(AdvisedSupport.java:557)
        at sun.reflect.GeneratedMethodAccessor130.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1058)
        at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2136)
        at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2027)
        at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1535)
        at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2245)
        at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2169)
        at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2027)
        at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1535)
        at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2245)
        at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2169)
        at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2027)
        at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1535)
        at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2245)
        at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2169)
        at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2027)
        at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1535)
        at java.io.ObjectInputStream.readObject(ObjectInputStream.java:422)
        at org.springframework.core.serializer.DefaultDeserializer.deserialize(DefaultDeserializer.java:70)
        at org.springframework.core.serializer.support.DeserializingConverter.convert(DeserializingConverter.java:73)

[kshitij-kasliwal]

and its happening post adding OAuth2ClientAuthenticationProcessingFilter in filter chain. Without this filter, application runs fine without any glitches.

[dsyer]

The stack traces are interesting, but they don't really tell anyone how to reproduce the problem. Could someone create a simple sample project and post it on github, please?

[kshitij-kasliwal]

We are using spring-boot and spring-security in micro-services architecture. Where one of the micro-service is used for OAuth2 authentication purposes and other micro-service is being used as data store. Post authentication, session and token values get stored in redis token store. And on subsequent calls to data micro-service session and token gets validated via some authentication filters.

Till date we weren't using OAuth2ClientAuthenticationProcessingFilter to intercept OAuth2 auth code flow requests for redirection and was using a custom authentication filter which follows password flow for OAuth where filter was responsible to authenticate the user using identity provider API calls.

Now, after introducing OAuth2ClientAuthenticationProcessingFilter for intercepting authentication calls , authentication and token validation in authentication micro-service is working fine. But on request to data micro-service, during the call to fetch session "RequestContextHolder.currentRequestAttributes().getSessionId()", this error is thrown.

Stack trace :

org.springframework.data.redis.serializer.SerializationException: Cannot deserialize; nested exception is org.springframework.core.serializer.support.SerializationFailedException: Failed to deserialize payload. Is the byte array a result of corresponding serialization for DefaultDeserializer?; nested exception is java.lang.ClassCastException: cannot assign instance of org.springframework.beans.factory.support.StaticListableBeanFactory to field org.springframework.aop.scope.DefaultScopedObject.beanFactory of type org.springframework.beans.factory.config.ConfigurableBeanFactory in instance of org.springframework.aop.scope.DefaultScopedObject
	at org.springframework.data.redis.serializer.JdkSerializationRedisSerializer.deserialize(JdkSerializationRedisSerializer.java:82)
	at org.springframework.data.redis.core.AbstractOperations.deserializeHashValue(AbstractOperations.java:338)
	at org.springframework.data.redis.core.AbstractOperations.deserializeHashMap(AbstractOperations.java:282)
	at org.springframework.data.redis.core.DefaultHashOperations.entries(DefaultHashOperations.java:227)
	at org.springframework.data.redis.core.DefaultBoundHashOperations.entries(DefaultBoundHashOperations.java:102)
	at org.springframework.session.data.redis.RedisOperationsSessionRepository.getSession(RedisOperationsSessionRepository.java:432)
	at org.springframework.session.data.redis.RedisOperationsSessionRepository.getSession(RedisOperationsSessionRepository.java:402)
	at org.springframework.session.data.redis.RedisOperationsSessionRepository.getSession(RedisOperationsSessionRepository.java:245)
	at org.springframework.session.web.http.SessionRepositoryFilter$SessionRepositoryRequestWrapper.getSession(SessionRepositoryFilter.java:327)
	at org.springframework.session.web.http.SessionRepositoryFilter$SessionRepositoryRequestWrapper.getSession(SessionRepositoryFilter.java:344)
	at org.springframework.session.web.http.SessionRepositoryFilter$SessionRepositoryRequestWrapper.getSession(SessionRepositoryFilter.java:217)
	at javax.servlet.http.HttpServletRequestWrapper.getSession(HttpServletRequestWrapper.java:231)
	at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationDetails.<init>(OAuth2AuthenticationDetails.java:60)
	at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationDetailsSource.buildDetails(OAuth2AuthenticationDetailsSource.java:31)
	at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationDetailsSource.buildDetails(OAuth2AuthenticationDetailsSource.java:27)
	at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter.doFilter(OAuth2AuthenticationProcessingFilter.java:148)

[kshitij-kasliwal]

If i read the session key data from redis, i see additional 2 attributes in the map which are namely -

11. "sessionAttr:scopedTarget.oauth2ClientContext"
12. "\xac\xed\x00\x05sr\x00Eorg.springframework.security.oauth2.client.DefaultOAuth2ClientContext......... "

These attributes don't get logged in the redis store if i don't use OAuth2ClientAuthenticationProcessingFilter.

[dsyer]

Thanks for the update. Can you please learn how to format logs and code snippets using markdown?

[dsyer]

Also, we're still waiting for a sample app if anyone has time to create one.

[kshitij-kasliwal]

Formatted stack-trace :

org.springframework.data.redis.serializer.SerializationException: Cannot deserialize; nested exception is org.springframework.core.serializer.support.SerializationFailedException: Failed to deserialize payload. Is the byte array a result of corresponding serialization for DefaultDeserializer?; nested exception is java.lang.ClassCastException: cannot assign instance of org.springframework.beans.factory.support.StaticListableBeanFactory to field org.springframework.aop.scope.DefaultScopedObject.beanFactory of type org.springframework.beans.factory.config.ConfigurableBeanFactory in instance of org.springframework.aop.scope.DefaultScopedObject
	at org.springframework.data.redis.serializer.JdkSerializationRedisSerializer.deserialize(JdkSerializationRedisSerializer.java:82)
	at org.springframework.data.redis.core.AbstractOperations.deserializeHashValue(AbstractOperations.java:338)
	at org.springframework.data.redis.core.AbstractOperations.deserializeHashMap(AbstractOperations.java:282)
	at org.springframework.data.redis.core.DefaultHashOperations.entries(DefaultHashOperations.java:227)
	at org.springframework.data.redis.core.DefaultBoundHashOperations.entries(DefaultBoundHashOperations.java:102)
	at org.springframework.session.data.redis.RedisOperationsSessionRepository.getSession(RedisOperationsSessionRepository.java:432)
	at org.springframework.session.data.redis.RedisOperationsSessionRepository.getSession(RedisOperationsSessionRepository.java:402)
	at org.springframework.session.data.redis.RedisOperationsSessionRepository.getSession(RedisOperationsSessionRepository.java:245)
	at org.springframework.session.web.http.SessionRepositoryFilter$SessionRepositoryRequestWrapper.getSession(SessionRepositoryFilter.java:327)
	at org.springframework.session.web.http.SessionRepositoryFilter$SessionRepositoryRequestWrapper.getSession(SessionRepositoryFilter.java:344)
	at org.springframework.session.web.http.SessionRepositoryFilter$SessionRepositoryRequestWrapper.getSession(SessionRepositoryFilter.java:217)
	at javax.servlet.http.HttpServletRequestWrapper.getSession(HttpServletRequestWrapper.java:231)
	at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationDetails.<init>(OAuth2AuthenticationDetails.java:60)
	at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationDetailsSource.buildDetails(OAuth2AuthenticationDetailsSource.java:31)
	at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationDetailsSource.buildDetails(OAuth2AuthenticationDetailsSource.java:27)
	at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter.doFilter(OAuth2AuthenticationProcessingFilter.java:148)

[aol-nnov]

@dsyer I believe the code in question is something like https://github.com/kakawait/uaa-behind-zuul-sample with redis session instead of JWT token.
Some time ago I was trying that sample with spring session approach and failed due to deserialization exception. googled here and there, tried different excerpts from github issues and such, finally went back to JWT tokens.
Sad to say, as for now I don't have time to make a pure sample too..

[sanaulla123]

@dsyer
Exactly related to spring-attic/spring-security-oauth#705

When we added (work around mentioned: #395)

spring.application.name=application
spring.application.index=1

to both the applications, the issue was resolved.

But we wouldn't want two different applications to have the same name (this will cause issues when we use centralised configuration)

The bug https://jira.spring.io/browse/SPR-14117 has been marked as fixed, but the resolution was not mentioned. I am using the latest spring boot 1.5.4.RELEASE

[dsyer]

I didn't see a sample app there (just references to other issues, and they are all marked as "fixed"). The resolution might to be to simply make your application context id unique. Hard to say without a sample.

[kshitij-kasliwal]

I am working on to create a sample app. Just to clarify on your earlier comment, application names used for both the micro-services are different. In one case it is "security" and in another it is "core", which as per my understanding makes application context id unique.

[sanaulla123]

I don't see the issues I have linked being fixed because the issue of xxBeanFactory also being serialised along with the scoped object still exists. And if we don't follow the WA mentioned for Boot applications in #395 then we keep encountering this issue.

The fact that you were involved in spring-attic/spring-security-oauth#705 and also in https://jira.spring.io/browse/SPR-14117 made me think that you could get the context for the issue.

Creating a sample app might take some time due to our other commitments.

@kshitij-kasliwal try to provide same application name and try it. It should work without any issue

[kshitij-kasliwal-bkst]

Sample app can be fetched from https://github.com/kshitij-kasliwal-bkst/springboot-oauth2-sample.

It consists of 2 spring-boot application, one is security (port:8080) which is used for authentication and another is core (port:8081) which is used as data micro-service. Once application is up, load http://localhost:8080 on the browser. After performing authentication from google, page will show name of the currently logged in user. On this page, load http://localhost:8081/user on the browser.